Privacy.

Board Badger is operated by Dale Mooney, a sole trader based in the United Kingdom, referred to here as the Operator. This notice is kept short on purpose: it is the whole of what the service does with personal data.

Who is responsible for what

There are two roles here, and which one applies decides who answers a request.

The Operator is the controller of account data: the email address an account holder signed up with, their password hash, and the record of their own use of the service. Requests about that go to the Operator, and the Operator answers them.

The Operator is a processor of everything on a board: its name, its tasks, the notes and comments on them, and the name and email address of each person invited to it. The account holder is the controller of all of that. They decide what goes on a board and who may read it, and the Data Processing Agreement sets out the terms the Operator holds it under.

What is held

For an account holder: the email address they signed up with, a hash of their password, and the boards they keep. For a board: its name, the client's name, and every task on it, with its title, its notes, its state and the comments left on it.

For somebody invited to a board: the name and email address the account holder entered, the role they were given, which board it was, and the record of what they ticked off or commented on. Those details are entered by the account holder about their own client contacts.

What it is used for

To run the board, to send the invitation that opens it, and to tell the people on a board when a task moves or a comment lands. Email is sent through Resend. Everything else is held in Cloudflare D1, the database Board Badger runs on.

There is no analytics on this site, no advertising, and no third party script other than the Cloudflare Turnstile bot check on the sign up and sign in pages.

Cookies

Three, all strictly necessary, set out in full in the cookie notice. None of them tracks anybody across sites.

Keeping it, and deleting it

A board is kept for as long as its account is open, because that is the product. Revoking somebody's access ends it at once and keeps their name against the tasks they ticked off: a board that forgets who did what stops being a record. Email already sent sits in Resend's own sending log for a short period, which is outside the Operator's control beyond the choice of provider.

Closing an account is done by hand. There is no button for it in the product yet. Write to privacy@boardbadger.com from the account's own address and the Operator deletes the account, its boards, their tasks, their comments and the membership records, within one month and usually far sooner. Residual copies sit in the hosting provider's automated backups until those age out on the provider's own schedule.

Rights, and how to use them

Under UK GDPR an account holder may ask for a copy of their data, ask for it to be corrected or deleted, or object to how it is used. Requests go to privacy@boardbadger.com and are answered within one month. There is no charge.

Somebody invited to a board is in the other half of the split above. Their name and address are on a board their own client or supplier controls, so a request about what is on that board goes to the account holder who invited them. Writing to the Operator at the same address still works: the request is passed to that account holder without delay, the Operator assists them in answering it, and the person who wrote is told that is what has happened.

Anyone unhappy with the response may complain to the Information Commissioner's Office at ico.org.uk.